According to Brian Krebs, the hackers stole login credentials from the HVAC systems company Fazio Mechanical Services.